From the Book

After an IRT is established, your next concern is how to successfully operate your team. This chapter covers the following topics to help you improve the operation of your IRT:

Team size and working hours

New team member profile

Advertising team’s existence

Acknowledging incoming messages

Cooperation with internal groups

Prepare for the incidents

Measure of success

Team Size and Working Hours

One of the more common questions that organizations setting up their incident response team ask is, “How large should an IRT
be?” Providing that budget is not a constraint, the team’s size is a function of what services the IRT wants to provide, the
size and the distribution of the constituency, and planned working hours. (That is, will the IRT operate only during office
hours or around the clock?) In practice, if you are starting from scratch and the IRT’s task is defined as “go and deal with
the incidents,” a small team should be sufficient for the start. The first 12 to 18 months of the IRT’s operation can show
whether you need more people on the team.

Many teams after their formation operate only during the office hours. (For example, if you are in western Europe, that would
be Monday through Friday from 09:00 to 17:00.) For this kind of coverage a two-person team should suffice. Although office-hours
coverage is fine for the start, the IRT should look into extending its working hours to be active around the clock.

The main reason for extending the working hours is that some services (for example, a public website) are available at all
times. If someone compromises computers providing these services, the IRT must be able to respond swiftly and not two days
later after the weekend is over. Miscreants do not work standard office hours, so the IRT must do the same.

One of the standard ways to extend working hours is to have someone who is on-call. This person can answer telephone calls
and check incoming emails after hours and over the weekend. This setup can be augmented by cooperating with other teams. If,
for example, the IT has someone who is on-site outside office hours, the IT person might be the one who will accept telephone
calls, monitor emails, and alarm the IRT only when needed.

From a technical perspective, it is easy to have someone on-call. It is not necessary to have someone in the office because
modern, smart mobile telephones can receive and send emails, surf the Internet, and you can even use them to talk. Smart telephones
generally cannot do encryption, so you would need to devise a way to decrypt and encrypt messages. From a staffing perspective,
if you want around-the-clock and weekend coverage, the number of the people in IRT would depend on whether the duties can
be shared with other teams in the organization. If the duties can be shared, you might not need to increase the size of the
IRT. If not, increasing the team size should be considered. A three-member team might be a good size given that one person
might be on vacation and another might be sick, which would leave only one active person. Although two people can also provide
around-the-clock coverage, it would be a stretch and might burn them out if they would operate that way for a prolonged period
of time.

If the host organization is within the EU, it must pay attention to the European Working Time Directive (Council Directive
93/104/EC and subsequent amendments), which regulates that the working week must not be longer than 48 hours, which also includes
overtime. On the other hand, people might opt-out from the directive and work as long as required. The host’s human resources
department must investigate this and set up proper guidelines.

Irrespective of what hours the IRT operates, that fact must be clearly stated and communicated to other teams and the constituency.
Do not bury it somewhere deep in the documentation but state it prominently close to the place containing the team’s contact
details. Setting the right expectations is important.

When the IRT operates only during office working hours, the team must not forget that it is living in a round and multicultural
world. Living in a round world means that the team must state its time zone. Do not assume that people will automatically
know in which time zone the team operates based just on the city and the country. It is possible that the constituency, or
larger part of it, is actually situated in a different time zone from the one in which the IRT physically operates.

A multicultural world means that people in one country have different customs from people in other countries. We do not necessarily
have weekends or holidays on the same days. Take an example of an IRT that operates from Israel and a large part of its constituency
is in Europe. Will it operate on Saturdays? What are its office hours? Will it work on December 25th? The people who report
an incident to the team might not know these details in advance. It might be the first time they are reporting something to
the team, and they do not know what to expect. The point is that all the information related to your working hours must be visibly
and clearly stated on your team’s website.

Digression on Date and Time

While on the topic of a multicultural world, we must mention date and time formats. You always must use an unambiguous format
for the date and time. To that end, ISO 8601 is strongly recommended to be adopted by the IRT. In short, according to the
ISO 8601, a date should be written in YYYY-MM-DD and time in hh:mm:ss format. ISO format is suitable when the data is automatically
processed. Because not all people are familiar with the ISO 8601 standard, it is highly recommended to use the month’s name
(for example, October or Oct) instead of its number in all correspondence. That way, you can eliminate any possible ambiguity
on a date. When sending data that is a result of some automated process or that will be processed, you should also add a note
that all dates are in the ISO format so that recipients know how to interpret them.

As far as the time is concerned, do not forget to include the time zone. This is especially important if recipients are in
different time zones. You can either use the time zone’s name (for example, “GMT” or “Greenwich Mean Time”) or the offset
from the GMT (for example, GMT + 0530—GMT plus 5 hours and 30 minutes). The preference should be to include the offset rather
than the time zone’s name because the names can be ambiguous. For example, EST can mean either Eastern Summer Time or Eastern
Standard Time. Eastern Summer Time is used in Australia during the summer, and its offset from GMT is 11 hours (GMT + 1100).
On the other hand, Eastern Standard Time can be in either Australia or North America. The Eastern Standard Time in Australia
is used during the winter and is 10 hours ahead of GMT (GMT + 1000), whereas the same Eastern Standard Time in North America
has an offset of –5 hours from GMT (GMT – 0500).

One good website related to time zones is time and date.com, owned and operated by Time and Date AS. It is at http://www.timeanddate.com and is useful when dealing with multiple time zones.